Posts by Pascal Monett

Bored at home? Cisco has just the thing: A shed-load of security fixes to install, from a Kerberos bypass to crashes

It's okay though

Let's not forget that only Huawei has shoddy programming practices.

That's what the experts say.

If it feels like the software world is held together by string and a prayer, we don't blame you: Facebook SDK snafu breaks top iOS apps

Uncalled for ? Really ?

With the amount of people who just include a library on GitHub and never worry about what it actually does until said library falls over, it's not really uncalled for.

Personally, where I to include someone else's library, I would import it into my code stack, review the code to ensure that it does what it says on the tin and nothing else, and - after testing the thing to hell and beyond - include it in my production code stack.

Of course, it is then up to me to set a watch over that library to check when it is updated and what the update is, but that's my problem.

The rub is, developers hate problems, so they just link to library and let history run its course.

It's not because, in this particular case, developers had no way to avoid the issue that the argument does not stand.

If you miss the happier times of the 2000s, just look up today's SCADA gear which still has Stuxnet-style holes

So, basically, authentication is useless ?

How can you possibly design a program to accept commands if the user is not authenticated first ?

I just cannot fathom how it is possible for a developer to not design the code to stay in the authentication ring until that is validated. You can't program defensively against everything, but you sure as hell can refuse any input before validating a user's right to send commands.

Behold: The ghastly, preening, lesser-spotted Incredible Bullsh*tting Customer

I had a similar issue in one of my consulting gigs. I had created the application that the user had specced, and testing had gone swimmingly until one day the user called and complained that his notifications in said application were not going out to the right people.

I checked the code and the logs, and could find nothing wrong. I racked my brain trying to find out what the issue could actually be. After two days of searching, I finally hit upon an idea : he was using a local group that was named the same as the group defined on the server.

Not bothering with asking him the question because I was sure he'd deny any fault on his part, I simply changed the log to record the actual names of the people that were supposed to be notified. Sure enough, the next time he called to complain that it was _still_ not sending to the proper people, I checked the log and compared it to the server group : not equal.

I printed out the log and went to his desk and confronted him with the proof.

Never heard of him again.

Re: I quit left shortly thereafter

Whether you quit left or right, I'm sure it was the best professional decision you've ever made.

What do you call megabucks Microsoft? No really, it's not a joke. El Reg needs you

I'll drink to that.

I think Borkzilla is actually extremely appropriate.

Samsung to launch debit card and financial-health-as-a-service service

"Google is rumored to be working on a debit card of its own"

Of course it is. Another source of ad information - and this time, it's financial !

Every little bit counts - and Google never counts anything under a billion.

Go on, hit Reply All. We dare you. We double dare you. Because Office 365 will defeat your server-slamming ways

One company I worked at found a different solution

They removed the Reply All button from the ribbon. As it was an admin profile thingy, people couldn't put it back.

I think that's a great solution. There's not very many cases where absolutely everyone needs to know that you prefer pizza.

FYI: Your browser can pick up ultrasonic signals you can't hear, and that sounds like a privacy nightmare to some

Re: Surely one answer would be...

Maybe, maybe not.

But I have one sure-fire solution : mute the speakers.

At home, of course, my speakers can be active, especially now that I have somewhat more time for YouTube. But I use uBlock Origin with NoScript on Firefox, so I don't see ads, therefor they cannot spout any ultrasonic anything.

With my laptop, I also use the same browsing configuration but, on top of that, I have my speakers muted. Good luck spouting any noise whatsoever.

So, whether or not an app is listening, I am the deep sea nuclear submarine that passes unnoticed.

As coronavirus catches tech CEOs with their pants down, IBM's Ginni Rometty warns of IT's new role post-pandemic

IT departments perhaps not modern enough

To be "modern", they need budget. It's hard to get budget when you're considered nothing more than a cost center.

So who is to blame ?

Right.

HCL finishes its year with 15 percent growth, 100 million minutes-a-month Teams usage

"CEO C Vijayakumar said he thinks the company can navigate the current economic turbulence"

Well he's not going to say that they're going to go bankrupt, now is he ?

That was a useless sentence.

Non-human Microsoft Office users get their own special licences

“Office applications have not been specifically designed for unattended usage at scale”

Wrong. They have not been designed for any usage at scale.

Australian contact-tracing app sent no data to contact-tracers for at least ten days after hurried launch

Officials need to re-read the Cloud Act.

Basically put, nobody's data is safe from US scrutiny if it is stored on a server that is controlled by a company that has a presence in the USA. And no judge is going to go against that.

Excerpt from the article :

"First, the Act amended U.S. law to authorize U.S. law enforcement to unilaterally demand access to data stored outside the U.S."

It's a demand, not a request.

Quick Q: Er, why is the Moon emitting carbon? And does this mean it wasn't formed from Theia hitting Earth?

Yeah, mainly all the craters that pockmark its surface.

Forever mothballed: In memoriam Apple Butterfly Keyboard (2015-2020)

So, basically, you're defending a keyboard that you don't use.

Never underestimate the negative power of frustration. When you're forced to work with tools that have been specifically designed to keep you from working, you're life quickly becomes far from incredible.

'A' is for ad money oddly gone missing: Probe finds middlemen siphon off half of online advertising spend

"the online ad industry urgently needs to work together"

No they don't. They can continue ripping each other off as long as they like.

Besides, all it takes is an honest intermediary to do the job right, and the whole thing will crumble.

The problem is, they're all thieves. They can choke on their fees.

Senior MP tells UK Defence Committee on 5G security: Russia could become China's cyber-attack dog

Agreed. Putin is subservient to no one. Does this Elwood remember that Russia and China have been on the brink of open warfare several times in the past ? They re both itching for a fight.

So Huawei has rather shoddy coding practices. You're telling me that Cisco doesn't ? I seem to remember a rather embarrassing goof not so long ago, one that actually forced Cisco to offer a free replacement.

No, this is just another excuse for laying it on Huawei. They have no proof of anything, but since they're "experts", they can spout their bile without needing proof.

MongoDB and Rockset link arms to figure out SQL-to-NoSQL application integration

"Rockset replicates MongoDB data and builds an external index"

So you're doing a Join in memory and writing it down in an "external index".

You're still doing a Join.

Tom Cruise to increase in stature thanks to ISS jaunt? Now that's a mission impossible

Well that'll be a first in the film industry

Tom Cruise in Space. Actors : 1. Film crew : 5. Makeup : 1. Catering : 2. Budget : $1.2 billion.

Special effects : none. Explosions : none. Car chases : 0. Tom Cruise running time : 0 minutes.

Film gross : $250 million. Oops.

Now we know what the P really stands for in PwC: X-rated ads plastered over derelict corner of accountants' website

Right, so basically PwC created a sub-domain, decided not to keep it alive, and someone else took control. That's not hacking in any way, shape or form.

Eclipse boss claims Visual Studio Code is an open-source poseur – though he would say that, wouldn't he?

Eclipse

I have a personal bone to pick with that pile of crap. Ever since IBM shoved Notes into Eclipse on R7, the Notes developer client has gained an unstability that it never had before. You do your normal programming of agents or script libraries, you check the results in views and such, and all of a sudden, you're not getting the result you know you should get.

Well, after a while and a lot of experience, you understand that your Notes environment has gone to the dogs, with one or more processes than you are actually using. I don't know what Eclipse does, but it fails to remain in the processes that should normally be running and creates new ones without asking your opinion, thus you're doing something in a process that no longer has anything to do with the one you were coding in.

It's fucked up, and the only solution is to use the Task Manager to kill all Notes processes and get a clean situation - until it fucks itself up again, that is.

I hate Eclipse.

It has been 20 years since cybercrims woke up to social engineering with an intriguing little email titled 'ILOVEYOU'

Of course not. It was a Microsoft move.

We beg, implore and beseech thee. Stop reusing the same damn password everywhere

Re: I reuse the same password on loads of sites

I will admit that I have a throwaway password for sites that I do not consider important, yet still ask me for a login, or sites that I have no intention to return to after the reason for which I went there in the first place.

But for anything important, I have a system that gives me at least 13 characters, and I have a database to store them in along with the URL that is concerned.

UK finds itself almost alone with centralized virus contact-tracing app that probably won't work well, asks for your location, may be illegal

Re: your location is known static constant in this, you're at home

Well yes, unless you work in the food industry, in the transport industry, in the medical field, in a gas station, or in any other "essential" business.

So there's a few people who are _not_ at home.

You said everything we need to know

"She was also fighting for her quango"

That's a wrap, we're done with that shit.

Congratulations, Kieren

Once again, an outstanding piece of journalism which sets the record straight.

Well done.

Proof-of-concept open-source app can cut'n'paste from reality straight into Photoshop using a neural network

Re: OK, I'll bite.

Well, the article does state that "Support for other imaging editing programs in the works, wee're told".

How long that will take, if it ever happens, is anyone's guess.

Contact-tracing is basically CRM so we think we've got it sorted, says Salesforce

Salesforce should sign up to the Google-Apple API

We're in the midst of the greatest disruption to our lives that has ever happened outside of a World War (which most of us have never known), most of us are consigned to our houses with little opportunity to get out, and Salesforce is looking to sell us something that we're going to be getting for free to help us emerge from our hobbit holes.

Two of the greatest money hoarders have teamed up to make this happen for free, and Salesforce wants to sell us something that is supposed to do the same thing.

I guess that's marketing for you.

Hyperconverged darling Nutanix to furlough at least a quarter of its staff – 1,465 – for two weeks this year

"investors gave its share price a walloping"

Seems like now is the time to buy, then. There will be a life after the pandemic, and Nutanix should still be around, so get 'em while they're at a lowered price thanks to investor shortsightedness.

Smartphone shipments plummet in Q1 as users, er, lock down their spending

So they're still making 80% of their sales ?

We're locked in, nowhere to go, hooked on Internet at home at they are still making 80% of their previous quarter in sales ?

Really ? What is it going to take to make people stop buying phones for ten bloody minutes, a 20km-wide asteroid ?

Latvian drone wrests control from human overlords and shuts down entire nation's skies

"Latvian airspace could be closed for most of this week"

Um, what's to say that Latvia is the only country that can be affected ? At 70km/h for 90 hours, that's a potential 6300km distance. Even if it's going around in circles, there's a possibility that it goes over a border somewhere, given that Latvia seems to be barely 600 km wide and lass than half of that high (on the map, that is).

Oh, and who was the genius that thought it was a good idea for a test to fill the tank for 90-hour flight capability ? If you're doing a 2-hour test, give it 5 hours of fuel, that'll be largely enough. I think somebody thought "to hell with this, I'll fill 'er up this week so they won't bother me with this until next week".

The Great British anti-5G fruitcake Bakeoff: Group hugs, no guns, and David Icke

That is the unfortunate reality. When you believe a conspiracy, anything that is done against your movement is proof that you're right.

It takes an intelligent mind to question one's beliefs, and it takes a truly intelligent mind to do so despite being absolutely convinced that you are right.

Einstein and Hawking were truly intelligent minds who both ended up admitting they were wrong on some point. Anti-5Gers are no Einsteins.

Gmail and Outlook sitting in a tree, not t-a-l-k-i-n-g to me or thee

Re: is the problem just that I'm not down with the cool kids?

Probably that. But neither am I, you know. I use Gmail for my professional mail only. For the rest, I have a French national mail account (with La Poste, the French mail service), and then I have my personal mail server for everything strictly private, between friends and a special spam account for when I have to sign up to some site that doesn't deserve it.

I access my Gmail with a Chrome, obviously (work, remember ?), but I forward everything I get to one of my personal accounts which I access with Lotus Notes via POP.

For all the rest of my email accounts, I use Thunderbird, which is configured to not leave mail on the server. And I purge my Gmail account as soon as a thread is no longer relevant.

In other words, my mail is local, I don't leave it on someone else's server. Not even mine.

Facebook's mega-chatbot has 'a persona, discusses nearly any topic, shows empathy.' Perfect for CEO version 2

“hallucinating knowledge”

It is dangerous when so-called experts in their field confuse a statistical analysis machine with actual AI.

Their software is not hallucinating anything, it is spewing what its black box analysis tells it to.

Put a frakking activity log on your contraption and check what the hell it is doing.

India makes contact-tracing app compulsory in viral hot zones despite most local phones not being smart

"India’s IT minister has even labelled it 'foolproof' "

India’s IT minister is going to learn the truth about fools. There's always a better one.

Google Australia says government pulled pin on content-for-cash talks, hands in its homework anyway

Hang on there a minute

"publishers have always paid distributors of their content yet Google performs the same service for free"

Of course you do. You do it for free because you slap your ads on content you scrape from them, and you make billions from it.

If, on top of that, you were demanding payment from the publishers, that would just be taking the piss.

You started your business on scraping without asking permission. When there was an uproar, you made specious arguments about how you were doing nothing wrong. When that didn't work, you cut the newsfeeds and the publications activity dropped like a stone, which prompted them to come back begging for you to continue scraping.

It's not because you have managed to place yourself in a position of power that you can justify it by how it works now. That's like the blackmailer saying "hey, they're not complaining, what's your problem ?".

Singapore to require smartphone check-ins at all businesses and will log visitors' national identity numbers

"checks visitors into and out of their premises using their smartphones"

Nice idea, unfortunately when I travel abroad, I don't take my phone.

So, what's the solution there ? Do I get a government-approved phone to trace me ?

I would actually have no problem with that. Use it as prescribed while I'm there, give it back when I leave. Sounds perfect to me.

Britain has no idea how close it came to ATMs flooding the streets with free money thanks to some crap code, 1970s style

Re: "whoever was doing the testing"

Whoever it was, he was never employed at Boeing, apparently.

But honestly, this is not a tale of a major blunder saved in extremis. This is just a normal development cycle. Developer codes, tester tests, results come back and the cycle starts again until the code is approved for production.

That is exactly what happened.

Browse mode: We're not goofing off on the Sidebar of Shame and online shopping sites, says UK's Ministry of Defence

Re: .... excluding search engines ...

Yes it is. For a very specific kind of search, that is, but still.

So I've been told, that is.

Xiaomi what you're working with: Chinese mobe-flinger proffers two Redmi Note phablets for UK market

You're missing the goal. Trump is blocking Huawei because Cisco doesn't have proper 5G gear yet, and Huawei does.

Xiaomi is only a mobe maker, it is not in the comms infrastructure game, so does not risk treading on Cisco, so will probably be immune from Trump action.

As Brit cyber-spies drop 'whitelist' and 'blacklist', tech boss says: If you’re thinking about getting in touch saying this is political correctness gone mad, don’t bother

"problematic terms" ?

It's technology, not social relationship, stupid.

Yes, I am aware that the USA has a long history of repression of black people, and that history is being unfortunately regularly upheld by policemen every year, but you should not let that spill into a domain that has nothing to do with it.

The US is so lily-livered that I suspect they'll try and find something else to avoid saying "a black hole" in astronomy as well.

You can't ban the word black simply because you are responsible for having treated so many black people so badly. Tiptoeing around it just underscores your inherent racism.

Spyware slinger NSO to Facebook: Pretty funny you're suing us in California when we have no US presence and use no American IT services...

Re: But..

The problem is someone else butting in on their turf.

Bad precedent. Must be stopped. Facebook (and the NSA) are the only ones who can listen.

Re: NSO say they only provide their services to governments

Yeah, they say that, but where's the proof ?

And if you're going to put forward an argument of immunity, use the right one. Here, they tried sovereign immunity and that got shot down because duh, the NSO is not a country (something you'd think they should know), so now they try again with "derivative" sovereign immunity. That's going to get shot down as well because they are not acting on behalf of a government. Even I can see that and I'm not a lawyer.

The NSO is just another bunch of well-heeled clowns who think they're on top of the world and when they say something, it is the golden truth, no need to check. Well, whatever actually happened with WhatsApp, they're going to learn the hard way that judges do not take too well someone who invents new excuses every time their previous excuse gets invalidated.

Oracle faces claims of unequal pay from 4,000+ women after judge upgrades gender gap lawsuit to class action

"we look forward to trying those in court"

No you don't. The last thing Oracle wants is to have its internal practices laid bare in a court and take the risk of having a court decision make it change.

IBM was going to fight tooth and nail in much the same case of discrimination and it folded like a wet mop and settled to avoid a definitive decision.

I think that, if Oracle can, it will settle, because that will allow it to continue its practices which it probably believes will cost it less in the long run. The only question in my mind is : can it settle now that the case has class action status ? I don't know the rules on that.

Android trojan EventBot abuses accessibility services to clear out bank accounts – fortunately, it's 'in preview'

"The human link is the weakest link in cyber security"

Never have truer words been spoken. Truly secure procedures cannot actually be implemented because they impose so much inconvenience that humans automatically employ every imaginable workaround they can find.

Cue the one PC that can access patient records with the logon and password on a post-it on the screen.

Because people want convenience at any cost. Security is the opposite of convenient, because if it is convenient for you, it is also convenient for the hacker.

ICANN finally halts $1.1bn sale of .org registry, says it's 'the right thing to do' after months of controversy

"I applaud ICANN for stepping fully into their responsibility"

Sorry, but no applause shall be given to a group of greedy, selfish bastards who dearly hoped to keep the whole thing secret in order to pad their coffers.

It is nice to know that there are some elements of ICANN who do walk the path of righteousness, and their steadfast courage and willpower should be commended, but the Board in its generality has become a hive of scum and villainy and should be purged with fire, not applauded.

Cheshire Police celebrates three-year migration to Oracle Fusion by lobbing out tender for system to replace it... one year later

A 3-year migration, one year of use, and they want to replace it

Brilliant use of public funds there. Congratulations.

So now tell me, since it is obvious that the previous ERP was so terribly specced as to be useless, is it the same moron who is doing the specs for the new system ?

Or do you have so much money that you're just renewing ERP systems as you would go on holiday to a new island ?

India to build contact-tracing app for feature phones that still use 2G, don't have Bluetooth and can't run apps

Agreed as far as location is concerned. Maybe people with feature phones don't work in office buildings ?

But as far as tracking is concerned, all governments have no need of anything special, they can all pressure the operators to give the user location history already, so no loss of privacy there, it's already lost.

In trying times like these, it's reassuring to know you can still get pwned five different ways by Adobe Illustrator files

"This update resolves critical vulnerabilities"

Of course it does. And how many more does it introduce ?

Ah, Adobe, the treadmill of security patches.

Okay, I know, everyone is patching, but Adobe is in a special category of its own there. Even more special than Microsoft.